docs: def create_token(self, user):
          """
          Create a signed token from a user.
  
          """
          # The password is expected to be a secure hash but we hash it again
          # for additional safety. We default to MD5 to minimize the length of
          # the token. (Remember, if an attacker obtains the URL, he can already
          # log in. This isn't high security.)
          h = crypto.pbkdf2(
              self.get_revocation_key(user),
              self.salt,
              self.iterations,
              digest=self.digest,
          )
          return self.sign(self.packer.pack_pk(user.pk) + h)